Andreas> I would like to hack firewall-part of the kernel so that Andreas> it would not let through any java-script or java or Andreas> activ-x stuff. I think about some kind of string Andreas> recognition for Java-(script) and some recognition of the Andreas> file-name (*.ocx) for activ-X.

The kernel is not the right place for this. You'd be much better offusing a filtering HTTP proxy such as Muffin: